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1 . A method of network control, comprising: 

collecting real-time operation information on one or more first network elements of a 
5 network; 

selecting a policy to be implemented by at least one second network element, different 
from the first network element, responsive to the collected real time information from the one 
or more first network elements, the at least one second element including an end-point 
element of the network; and 
10 enforcing the selected policy on an agent hosted by the at least one second network 

element. 

2. A method according to claim 1, wherein collecting real-time operation information 
comprises collecting information on operation problems. 

15 

3. A method according to claim 2, wherein collecting real-time operation information 
comprises collecting information on applications that do not operate or operate slowly. 

4. A method according to claim 2, wherein collecting real-time operation information 
20 comprises collecting information on system or application crashes. 

5. A method according to claim 1, wherein collecting real-time operation information 
comprises collecting information on software applications installed or running on the network 
elements. 

25 

6. A method according to claim 1, wherein collecting real-time operation information 
comprises collecting information on the communications between elements of the network. 

7. A method according to claim 1, wherein selecting the policy to be implemented 
30 comprises selecting a policy relating to a software to be installed on the second network 

element. 
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8. A method according to claim 1, wherein selecting the policy to be implemented 
comprises selecting a policy relating to a software to be uninstalled from the second network 
element. 

5 9. A method according to claim 1, wherein selecting the policy to be implemented 
comprises selecting a policy relating to preventing installation of a software on the second 
network element. 

10. A method according to any of claims 7-9, wherein selecting the policy to be 
10 implemented comprises selecting responsive to a determination that a group of network 

elements having a common problem have installed thereon a specific software application or 
combination of software applications. 

11. A method according to claim 1, wherein selecting the policy to be implemented 
15 comprises selecting a policy relating to allocation of network resources. 

12. A method according to claim 1, wherein the policy is selected within less than 60 
minutes from the collecting of the information. 

20 13. A method according to claim 1, wherein collecting the operation information is 
performed repeatedly. 

14. A policy controller, comprising 
an input interface; 

25 an output interface; and 

a processor adapted to receive through the input interface real-time operation 
information on one or more first network elements of a network, to select a policy to be 
implemented by at least one second network element, different from the first network element, 
responsive to the collected real time information from the one or more first network elements, 

30 the at least one second element including an end-point element of the network and to transmit 
instructions on the selected policy to be enforced to an agent hosted by the at least one second 
network element, through the output interface. 
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15. A policy controller according to claim 14, wherein the processor is adapted to select 
the policy to be implemented by the at least one second network element responsive to 
operation information collected from at least 2 first network elements. 

5 16. A policy controller according to claim 15, wherein the processor is adapted to select 
the policy to be implemented by the at least one second network element responsive to 
operation information collected from at least 10 first network elements. 

17. A network management system, comprising: 
10 an input interface; 

an output interface; and 

a processor adapted to collect attribute values from a plurality of network elements of a 
network through the input interface, to find groups of network elements having similar 
attribute values for a plurality of attributes and to transmit a policy selected responsive to the 
15 groups, through the output interface. 

18. A system according to claim 17, wherein the processor is adapted to find, for a group 
of network elements having a problem, a combination of attribute values that correlate with 
the problem to at least a predetermined degree. 

20 

19. A system according to claim 17, wherein the processor is adapted to find, for a group 
of network elements having a problem, a combination of attribute values that appears only on 
the network elements having the problem. 

25 20. A system according to claim 17, wherein the processor is adapted to collect for at least 
one network element, a plurality of snapshot records of the network element at different times. 

21. A system according to claim 17, wherein the processor is adapted to verify that each 
network element belongs to the network before collecting information from the network 
30 element. 



22. A system according to claim 17, wherein the processor is adapted to find groups using 
a k-clustering or hierarchy clustering method. 
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23 . A method of network control, comprising: 

collecting attribute values from a plurality of computers having a problem; 
collecting attribute values from a plurality of computers not having the problem; and 
determining attribute values associated with the problem, responsive to the collected 
attribute values. 

24. A method according to claim 23, wherein determining the attribute values comprises 
determining using a neural network. 

25. A method according to claim 23, wherein determining the attribute values comprises 
determining using k-clustering or hierarchy clustering. 



39 



